fix(amika): use Admin workspace profile keys

[Saga4]

Summary

• consume the reusable Workspace Profile key produced by /admin/access
• require a freshly created no-Git Amika sandbox for every credential-bearing run
• stream Locality and Azure credentials over stdin without exposing them in argv
• forward HUP/INT/TERM through the top-level helper and reap transport descendants
• preserve existing Codex TOML source safely, including multiline values, quoted keys/tables, arrays, comments, and files without a trailing newline
• document the exact Admin-to-Amika workflow and key revocation

Validation

• make test-init-amika-locality-snapshot: passed
• focused shell test passed three consecutive times
• interruption test signals the public script and proves Expect/Amika descendants are gone
• bash -n on all changed shell scripts: passed
• git diff --check origin/main...HEAD: passed
• prior live preflight: pinned v0.3.7 binary present, hosted /ready returned 200, and expected CLI credential flags were present

Live E2E gate

The backend has now logged a successful Workspace Profile bootstrap request and PostgreSQL contains the corresponding sandbox session. A fresh plaintext Workspace Profile key is still required to prove materialization in a newly created Amika sandbox. The key must be generated by an authenticated operator at https://api.dev.locality.dev/admin/access; it is shown once and must not be committed, logged, or placed in argv.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
locality	Ready	Preview	Aug 3, 2026 10:40am

[Saga4]

Independent review found and the follow-up commit 4505e5d9 fixes:

• reusable Profile/Azure key inheritance through child process environments
• unbounded/misleading pre-sentinel SSH EOF handling
• broken headless/non-TTY Amika execution
• dirty or wrong-origin evidence checkout reuse
• repository mutation before backend authorization
• fragile repository discovery
• missing exact-key ownership documentation

Post-fix validation:

• fake transport suite passes, including one forced pre-secret disconnect/retry
• fake amika rejects either credential appearing in its environment
• real headless Amika execution reaches hosted profile-session creation and returns the expected structured 401 for a random key
• failed authorization leaves /home/amika/locality-snapshot absent and the evidence checkout clean

Positive scoped materialization remains gated only on a fresh Admin-generated Workspace Profile key.

[Saga4]

Rebased onto current main and added the final reusable-sandbox boundary hardening in 91d4d9b4:

• fresh sandboxes use --no-git; reused sandboxes must have the exact Locality origin and a clean worktree before credentials are transferred
• setup and scenario execution must leave the repository clean
• Codex runs from $HOME, outside the checked-out repository
• child signal exits and post-sentinel failures preserve their nonzero status and are never retried
• stdin is closed after credential transfer

Validation rerun: bash -n scripts/init-amika-locality-snapshot.sh tests/init_amika_locality_snapshot.sh, bash tests/init_amika_locality_snapshot.sh, and a real headless run against saga-locality-snapshot-2. The live run reached the hosted profile-session endpoint and failed closed with the expected structured HTTP 401 for an unrecognized test key; it created no snapshot. Positive materialization remains gated on a valid Workspace Profile sandbox key from /admin/access.

[github-actions]

Codex review

No high-confidence issues found.